refactor(skills): retrofit the corpus to the ADR-0020 context contract (#129)

Retrofits all 39 skills to ADR-0020's description/body context contract, then fixes what six rounds of independent review found in that retrofit — including four ways the hot gate itself failed open.

Closes #99, #107, #108, #110, #111, #114, #115, #120.

## The retrofit (waves 1-5)

| | Start | Now |
|---|---|---|
| Description FAILs (>400 chars) | 26 | **0** |
| Body FAILs (>900 words, body-only) | 9 | **0** |
| Dangling routing targets | 2 | **0** |
| `Kyberforge.CompositionNote` | 10 | **0** |
| Preload tax | 21,005 chars | **~10,500** |

Under the 12,000-char success criterion. Per-wave detail is on #99.

## The review fixes

**The gate failed open four ways, three of them found after the retrofit shipped.** An unrecognised follower token made a dangling target vanish. A skill directory with no `SKILL.md` resolved as a valid target, so a commit could be green locally and red in a fresh clone — three existing fixtures were relying on that, one of which made the install-leak A/B pass vacuously. Then the free-standing `/name` sweep turned out to be gated on the sentence carrying a boundary marker, so route notation in any other sentence was invisible — not an ERROR, not a SUGGESTION, not an INFO — which left the documented "`/name` always blocks" promise false from a second direction. All four fixed and pinned.

**Two checks were silently not running.** `validate-provenance.sh` checks 7-8 were dead across nine skills. Waking them exposed a deeper problem: they assume `Research doc:` names a source index, but 30 of 121 entries point at topic content documents, so every new check-7 INFO was a false positive and check 8 was saved from a false-FAIL flood only by an *unannounced* skip. Checks 7/8 are now scoped to source indexes and every skip announces itself (#121).

**The retrofit's own anti-goal, four times.** ADR-0020 warns that a blunt gate gets satisfied by deleting content rather than relocating it. `diagnose` and `skill-audit` relocated prose and then read it unconditionally; `prototype` and `vale-config` deleted rules outright that survived nowhere. All four addressed.

## Verification

- `bash tests/run-tests.sh --strict` — 24 suites, 0 skipped, 0 failed
- `bash tests/run-bats.sh` — 325 tests, 0 failures
- `pre-commit run --all-files` — 17/17
- `pre-commit run --hook-stage pre-push --all-files` — 16/16, with `apm marketplace check` and `apm pack --check-clean` run against the remote, not skipped
- `scripts/skill-size-check.sh` over all 39 skills — rc 0, 0 ERROR/FAIL, SUGGESTION-only
- Preload tax measured at **10,498 chars**, max description 390 — both inside budget
- Every new test proven non-vacuous by a deliberate mutation of the behaviour it covers

**Per-commit sync, stated accurately:** the ten commits from the latest review round each pass `check-plugin-content-sync` in isolation, verified by checking each out in a detached worktree with a clean between. The earlier gitea window (`dfacf05..bedbd1d`, nine commits) does **not** — its mirror was regenerated in one batch at `bbc7300`. An earlier revision of this description claimed the property held for every commit; it does not, and a bisect through that window lands on a red commit. **Squash-merge** to collapse it, or accept that this range is not bisectable.

## Version bump

Six plugins and the catalog take a **patch**, not a minor. The branch is **89 commits — 40 `fix` / 30 `refactor` / 12 `docs` / 5 `chore` / 2 `test` — zero `feat`, zero `!`, zero `BREAKING CHANGE`** — and adds no skill, agent, command or hook. (Two earlier revisions of this section cited a stale histogram, most recently 78 commits; the figures above are measured at HEAD.) Both rules this repo ships (`forge/references/version-bump.md`, landing in this PR, and `git-commits/references/conventional-commits-spec.md`) make that a patch, and the catalog set is unchanged at 7 entries.

Not settled by that: four published files were removed from the installed tree, three moved, and `caveman` gained `disable-model-invocation`, retiring its old triggers. Under a strict reading those are major-class and currently ship under `refactor:` with no marker. Whether the deployed skill surface is a public contract is written down nowhere — worth deciding, but it outlives this PR.

## Deliberately not in scope

#112 (cherry-pick ownership, now resolved in favour of `git-commits`), #113 (`rtk git` normalisation), #116 (research fan-out), #101 (audit-skill merge), #122 (non-spec skill-root files), #123 (no PRD producer) stay open. #117 is the one worth reading: the contract's remedy is to move prose into `references/`, which is exactly where neither the size gate nor Vale looks — and the blind spot is wider than #117 currently records, since there is no root `.vale.ini` at all, so every ADR, `CONTEXT.md` and `README.md` is unlinted too.

That blind spot let this branch carry two `level: error` `Kyberforge.SentenceOpenerThereIs` violations into `references/` files it created — `provider-adapter-author/references/provider-matrix.md:31` and `agent-audit/references/finding-criteria.md:95`. Both are reworded in `afadaae`, confirmed by routing each file through the audit's own `vale-wrap.sh` (1 error each before, 0 after). Five further occurrences sit in `references/` files already on `main`; those are the pre-existing corpus and stay with #117, which is the real fix.

Also unfixed and not this PR's: `apm install` appends a duplicate `SessionStart` entry to `.claude/settings.json`, so a fresh clone cannot get pre-push green without an edit AGENTS.md warns against. Reproduces identically on `main`.

Co-authored-by: Defame1297 <gitea@rkdr.net>
Reviewed-on: https://git.dev.rkdr.net/Defame1297/holocron/pulls/129
Co-authored-by: Claude Code AI - Gitea MCP <claude@noreply.git.dev.rkdr.net>
Co-committed-by: Claude Code AI - Gitea MCP <claude@noreply.git.dev.rkdr.net>

plugins/gitea/.apm/skills/gitea-branches/README.md

@@ -4,27 +4,40 @@ Manage Gitea repository branches and inspect commit history via the Gitea MCP se
 
 ## What it does
 
-This skill handles branch lifecycle operations (list, create, delete) and read-only commit
+This skill handles branch lifecycle operations (list, create, rename, delete) and read-only commit
 history (list commits, get a single commit's full detail) against a Gitea repository. It resolves
 `owner`/`repo` from the git remote, dispatches to the right MCP tool, and applies safety and
 pagination conventions specific to Gitea's API (e.g. refusing to delete a protected branch without
 explicit confirmation, and treating unexpected 404s as possible masked 403s).
 
+## Boundaries
+
+This skill operates on the Gitea server via the MCP tools, never on your local checkout. Branch
+and commit-history work against the working copy belongs to `git-branches` and `git-history`.
+Branch references that only exist relative to a pull request — a PR's head or base branch, and
+cross-repo fork PR heads in particular — belong to `gitea-prs`; `list_branches` cannot see a fork's
+head at all.
+
+The skill triggers on phrasings like "list branches", "create a branch", "rename a branch", "delete a branch",
+"what commits are on this branch", "show commit <sha>", and "what changed in that commit", even
+when the user does not say "Gitea", as long as the repo's remote is a Gitea instance.
+
 ## Before you start
 
 Requires a Gitea MCP server configured with a token that has `write:repository` scope. This is
-confirmed for `list_branches`, `create_branch`, and `delete_branch` (Gitea gates reads behind write
+confirmed for `list_branches`, `create_branch`, and `delete_branch` (and inferred for
+`rename_branch`) (Gitea gates reads behind write
 scope for repo-scoped operations); `list_commits` and `get_commit` are inferred to need the same
 scope by analogy, not explicitly confirmed — see `references/commits.md`. Requires a git remote
 named `origin` pointing at the Gitea instance.
 
 ## Usage
 
-```
+```text
 /gitea-branches
 ```
 
-Describe your task: list/create/delete a branch, or list/inspect commits. See `SKILL.md`'s
+Describe your task: list/create/rename/delete a branch, or list/inspect commits. See `SKILL.md`'s
 dispatch table for the full set of recognized invocations.
 
 ## Files
@@ -32,6 +45,6 @@ dispatch table for the full set of recognized invocations.
 | File | Purpose |
 |------|---------|
 | `SKILL.md` | Skill instructions for agents — dispatch table, gotchas |
-| `references/branches.md` | Verified call signatures and mechanics for list/create/delete branch |
+| `references/branches.md` | Verified call signatures and mechanics for list/create/rename/delete branch |
 | `references/commits.md` | Verified call signatures and mechanics for list/get commit |
 | `references/sources.md` | Research sources backing the branch/commit guidance |

plugins/gitea/.apm/skills/gitea-branches/SKILL.md

@@ -2,37 +2,30 @@
 name: gitea-branches
 
 description: >
-  Use when managing Gitea repository branches — listing, creating, or deleting
-  branches — or inspecting commit history within a Gitea repo: listing commits
-  (optionally filtered by branch or file path) or getting full detail for a
-  single commit by SHA. Triggers on "list branches", "create a branch",
-  "delete a branch", "what commits are on this branch", "show commit <sha>",
-  "what changed in that commit" — even if the user doesn't say "Gitea"
-  explicitly, as long as the repo's remote is a Gitea instance. Do not use for
-  local git branch/commit operations on your working copy (use git-branches or
-  git-history) or for PR-side branch references like cross-repo fork PR heads
-  (use gitea-prs).
+  Use when listing, creating, renaming, or deleting branches in a Gitea repository,
+  or reading its commit history — "what commits are on this branch", "what changed
+  in that commit" — even when the user does not say "Gitea". Not a
+  local checkout's branches -> `git-branches`. Not local history ->
+  `git-history`. Not a PR's head or base -> `gitea-prs`.
 
-compatibility: Requires Gitea MCP server configured with a token with write:repository scope; this is confirmed to gate list_branches, create_branch, and delete_branch (Gitea gates reads behind write scope for repo-scoped operations), and is inferred by analogy (not explicitly confirmed by source docs) to also gate list_commits and get_commit. Requires git remote "origin" pointing to the Gitea instance.
+compatibility: Requires Gitea MCP server configured with a token with write:repository scope; this is confirmed to gate list_branches, create_branch, and delete_branch (Gitea gates reads behind write scope for repo-scoped operations), and is inferred by analogy (not explicitly confirmed by source docs) to also gate rename_branch, list_commits, and get_commit. Requires git remote "origin" pointing to the Gitea instance.
 
 metadata:
   category: integration
-  version: "0.1.1"
+  version: "0.1.2"
   source_keys:
     - gitea-mcp-repo
     - gitea-mcp-slim-go
     - context7-websites-gitea
 
-allowed-tools: Bash mcp__gitea__list_branches mcp__gitea__create_branch mcp__gitea__delete_branch mcp__gitea__list_commits mcp__gitea__get_commit
+allowed-tools: Bash mcp__gitea__list_branches mcp__gitea__create_branch mcp__gitea__rename_branch mcp__gitea__delete_branch mcp__gitea__list_commits mcp__gitea__get_commit
 ---
 
 ## Gotchas
 
-- **Never delete a protected branch (`main`/`master` by name, or `protected: true` from `list_branches`) without explicit confirmation.** `delete_branch` is a direct API call, not a local `git push` — there is no client-side force-push guard protecting it. Name-matching `main`/`master` is a convenient default but not authoritative — a repo can protect a differently-named default branch. When in doubt, call `list_branches` first and check `protected` on the target; treat deletion of any protected branch as a hard refusal unless the user explicitly confirms in the conversation.
-- **404 may actually mean 403.** Gitea hides permission errors as not-found to avoid leaking resource existence. If any of these five tools returns 404 unexpectedly, check token scope (see `references/branches.md` / `references/commits.md`) before concluding the branch or commit doesn't exist.
-- **Pagination is manual.** `list_branches` and `list_commits` return one page at a time — no auto-pagination in the MCP layer. When you need a complete list, iterate `page: 1, 2, ...` until the returned count is less than `per_page`.
-- **Owner/repo always come from the git remote, never from `get_me`.** Resolve them via `git remote get-url origin` (Step 1 below). `get_me`/`list_my_repos` are blocked under the token scopes this skill assumes.
-- **`create_branch`'s source is `old_branch`, not "wherever gitea-mcp feels like."** Omitting `old_branch` forks from the repo's server-side default branch — not necessarily the branch you're currently working on locally. If you want to branch from your current checkout, pass `old_branch` explicitly.
+- **404 often means 403.** Gitea masks permission errors as not-found; on an unexpected one, check token scope before reporting a branch or commit missing.
+- **Nothing auto-paginates.** `list_branches` and `list_commits` return one page; iterate `page` until the returned count is below `per_page`.
+- **`delete_branch` has no force-push guard.** Treat deleting a protected branch as a hard refusal unless the user explicitly confirms it in the conversation. Check `protected` from `list_branches` first — a protected branch need not be named `main`.
 
 ## Step 1 — Resolve owner and repo
 
@@ -42,7 +35,7 @@ Before any tool call, extract `owner` and `repo` from the git remote:
 git remote get-url origin
 ```
 
-If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
+`get_me` and `list_my_repos` are blocked under the token scope this skill assumes, so the remote is the only source. If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
 
 ## Step 2 — Dispatch
 
@@ -50,17 +43,18 @@ If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea r
 |---|---|
 | `/gitea-branches` or `/gitea-branches list` | List branches |
 | `/gitea-branches create <name> [from <base>]` | Create branch |
+| `/gitea-branches rename <name> to <new-name>` | Rename branch |
 | `/gitea-branches delete <name>` | Delete branch |
 | `/gitea-branches commits [on <branch>] [touching <path>]` | List commit history |
 | `/gitea-branches commit <sha>` | Get full detail for one commit |
 
-For branch operations (list/create/delete), read `references/branches.md`.
+For branch operations (list/create/rename/delete), read `references/branches.md` — it carries the call signatures, the `old_branch` source rule, and the protected-branch refusal in full.
 For commit operations (list/get), read `references/commits.md`.
 
 ## Step 3 — Report
 
 For reads: display branches as name + protected flag; display commits as SHA (short), message summary, author, date.
 
-For writes (create/delete): confirm the action taken, the branch name, and (for create) the base it forked from.
+For writes (create/rename/delete): confirm the action taken, the branch name, and (for create) the base it forked from or (for rename) the name it had before.
 
-For errors: surface the HTTP code and message. If a 404 is unexpected, re-check token scope per the Gotchas above before reporting "not found" to the user.
+For errors: surface the HTTP code and message, applying the 404 gotcha above before reporting "not found" to the user.

plugins/gitea/.apm/skills/gitea-branches/references/branches.md

@@ -7,10 +7,11 @@ source_keys:
 
 # Branch operations
 
-Call signatures below were verified live against the deployed `gitea-mcp` server via `ToolSearch`
-at authoring time, not copied from research docs — this is deliberate: research docs are generated
-from source code at a point in time and can drift from the server actually deployed. Re-verify
-against the live schema if these tools appear to behave differently than documented here.
+Call signatures below were verified live against the deployed `gitea-mcp` server via `ToolSearch`,
+not copied from research docs — this is deliberate: research docs are generated from source code at
+a point in time and can drift from the server actually deployed. **Last verified against gitea-mcp
+v1.7.0**, as reported by `get_gitea_mcp_server_version`. Re-verify against the live schema if the
+deployed version differs or these tools behave differently than documented here.
 
 ## `list_branches`
 
@@ -21,7 +22,7 @@ against the live schema if these tools appear to behave differently than documen
 - `per_page` (number, optional, default: `30`)
 
 **Call:**
-```
+```text
 list_branches owner: <owner> repo: <repo>
 ```
 
@@ -41,7 +42,7 @@ count is less than `per_page`.
   branch server-side (not necessarily your current local checkout)
 
 **Call:**
-```
+```text
 create_branch owner: <owner> repo: <repo> branch: <new-name> old_branch: <source-branch>
 ```
 
@@ -53,6 +54,29 @@ top-level request with no working branch context), omit `old_branch` and let it
 
 A branch name collision returns `409 Conflict`.
 
+## `rename_branch`
+
+**Parameters:**
+- `owner` (string, required)
+- `repo` (string, required)
+- `branch` (string, required) — the branch's current name
+- `new_name` (string, required) — the name to move it to
+
+**Call:**
+```text
+rename_branch owner: <owner> repo: <repo> branch: <current-name> new_name: <new-name>
+```
+
+A rename moves the ref server-side; it is not a delete-plus-create, and no commit history is
+rewritten. What it does to things *pointing at* the old name — open pull requests using it as head or
+base, a branch protection rule matching it, CI config, and tracking branches on every other clone —
+is **not confirmed** by this skill's sources: the deployed tool describes itself only as "Rename an
+existing branch in a repository". Treat a rename of a branch with open PRs or a protection rule as a
+change needing verification afterward (`list_branches`, plus `gitea-prs` for the PR side), and
+confirm with the user first, exactly as for `delete_branch` below. A collision with an existing
+branch name is expected to return `409 Conflict` by analogy with `create_branch`, not separately
+confirmed.
+
 ## `delete_branch`
 
 **Parameters:**
@@ -61,11 +85,11 @@ A branch name collision returns `409 Conflict`.
 - `branch` (string, required)
 
 **Call:**
-```
+```text
 delete_branch owner: <owner> repo: <repo> branch: <name>
 ```
 
-Before calling this, see the hard-refusal Gotcha in SKILL.md. If the target branch's name isn't
+Before calling this, see the `delete_branch` Gotcha in SKILL.md. If the target branch's name isn't
 obviously a scratch/feature branch, call `list_branches` first and check `protected` on the
 matching entry — name-matching `main`/`master` alone isn't authoritative, since a repo can protect
 a differently-named default branch. Confirm explicitly with the user before deleting anything
@@ -73,9 +97,12 @@ protected, every time, regardless of how the request is phrased.
 
 ## Token scope
 
-All three — `list_branches`, `create_branch`, `delete_branch` — require `write:repository`. Gitea
+`list_branches`, `create_branch` and `delete_branch` all require `write:repository`. Gitea
 gates reads behind write scope for repo-scoped operations, so `list_branches` needs the same scope
 as the write operations, not `write:issue` alone. An earlier version of this doc claimed
 `write:issue` alone was sufficient for `list_branches`, based on empirical testing under a token
 that held both `write:issue` and `write:repository` simultaneously — that test didn't isolate the
 variable, so it couldn't actually establish `write:issue` alone as sufficient.
+
+`rename_branch` is a write on the same repo-scoped surface and is inferred to need `write:repository`
+too — inferred by analogy, not separately confirmed.

plugins/gitea/.apm/skills/gitea-branches/references/commits.md

@@ -8,8 +8,9 @@ source_keys:
 # Commit operations
 
 Read-only commit history, scoped to a repo (optionally to one branch or one path). Call signatures
-below were verified live against the deployed `gitea-mcp` server via `ToolSearch` at authoring time,
-not copied from research docs, for the same drift-avoidance reason noted in `references/branches.md`.
+below were verified live against the deployed `gitea-mcp` server via `ToolSearch`, not copied from
+research docs, for the same drift-avoidance reason noted in `references/branches.md`. **Last verified
+against gitea-mcp v1.7.0**, as reported by `get_gitea_mcp_server_version`.
 
 This domain has no prior skill precedent — it's new coverage added alongside branches because commit
 history is naturally scoped to a branch (a "what happened on this branch" question), not because it
@@ -27,7 +28,7 @@ shares any tool family with branch create/delete.
 - `per_page` (number, optional, default: `30`, minimum: `1`)
 
 **Call:**
-```
+```text
 list_commits owner: <owner> repo: <repo> sha: <branch-or-sha> path: <optional-path>
 ```
 
@@ -42,7 +43,7 @@ Dispatch defaults:
 **Response:** one object per commit: `sha`, `html_url`, `created`, `message` (when available),
 `author` (`{name, email, date}`, when available).
 
-Paginate per the manual-pagination Gotcha in SKILL.md if you need more than one page of history.
+Paginate per the pagination Gotcha in SKILL.md if you need more than one page of history.
 
 ## `get_commit`
 
@@ -52,7 +53,7 @@ Paginate per the manual-pagination Gotcha in SKILL.md if you need more than one
 - `sha` (string, required)
 
 **Call:**
-```
+```text
 get_commit owner: <owner> repo: <repo> sha: <commit-sha>
 ```
 
@@ -64,10 +65,10 @@ edge cases, `get_commit` will not.
 ## Token scope
 
 Both tools are believed to require `write:repository`, even though they're read-only — inferred by
-analogy with the scope-gating principle in `overview.md` (Gitea gates reads behind write scope for
-repo-scoped operations), not a claim `overview.md` makes for commits by name: its explicit
-`write:repository` enumeration lists PR, branch, file, release, and tag operations, but doesn't
-mention commits. An earlier version of this doc claimed `write:issue` alone worked, based on
+analogy with the scope-gating principle confirmed for branch operations in `branches.md`'s Token
+scope section (Gitea gates reads behind write scope for repo-scoped operations), not a claim any
+doc in this skill makes for commits by name: nothing here enumerates commits under
+`write:repository` explicitly. An earlier version of this doc claimed `write:issue` alone worked, based on
 empirical testing under a token that held both `write:issue` and `write:repository`
 simultaneously — that test didn't isolate the variable either. Treat this as unverified until
 tested under a token scoped to `write:issue` only (no `write:repository`).

plugins/gitea/.apm/skills/gitea-branches/references/sources.md

@@ -2,8 +2,8 @@
 
 **Note on call signatures:** per `docs/adr/0011-gitea-skill-deep-modules.md`, the tool parameter
 signatures in `references/branches.md` and `references/commits.md` were re-verified live via
-`ToolSearch` against the deployed `gitea-mcp` server at authoring time — they are not copied
-verbatim from `api-reference.md` below. This resolves issue #6 comment #849's root-cause finding
+`ToolSearch` against the deployed `gitea-mcp` server — **last verified against v1.7.0**, as reported
+by `get_gitea_mcp_server_version` — rather than copied verbatim from `api-reference.md` below. This resolves issue #6 comment #849's root-cause finding
 that a prior skill was authored from API docs that had drifted from the actual MCP tool schema.
 The research docs cited here informed gotchas, response shapes, and workflow context, not the
 parameter lists themselves.
@@ -11,7 +11,7 @@ parameter lists themselves.
 ## gitea-mcp-repo
 
 - **URL:** https://gitea.com/gitea/gitea-mcp
-- **Description:** Official gitea-mcp repository (v1.3.0); operation/*.go source files documenting all 55 MCP tools, their parameters, and CLI flags. Informed the dispatch table and pagination / 404-may-mean-403 gotchas in SKILL.md, and the list/create/delete branch and list/get commit mechanics (including 409 conflict and default-branch fallback behavior) in references/branches.md and references/commits.md.
+- **Description:** Official gitea-mcp repository; operation/*.go source files documenting the MCP tools, their parameters, and CLI flags. Extracted at v1.3.0; the parameter lists carried into this skill are re-verified live against the deployed server, last at v1.7.0. Informed the dispatch table and pagination / 404-may-mean-403 gotchas in SKILL.md, and the list/create/delete branch and list/get commit mechanics (including 409 conflict and default-branch fallback behavior) in references/branches.md and references/commits.md.
 - **Research doc:** plugins/gitea/docs/research/docs/gitea/sources.md
 - **Contributing files:** SKILL.md, references/branches.md, references/commits.md
 - **Status:** `extracted`
@@ -19,7 +19,7 @@ parameter lists themselves.
 ## gitea-mcp-slim-go
 
 - **URL:** https://gitea.com/gitea/gitea-mcp/raw/branch/main/operation/repo/slim.go
-- **Description:** Slim response shape structs from gitea-mcp source; defines exactly which fields the MCP server returns for branches (name, protected, commit_sha) and commits (sha, html_url, created, message, author), and informed get_commit's always-populated guarantee vs. list_commits' conditional fields.
+- **Description:** Slim response shape structs from gitea-mcp source, extracted at v1.3.0; defines exactly which fields the MCP server returns for branches (name, protected, commit_sha) and commits (sha, html_url, created, message, author), and informed get_commit's always-populated guarantee vs. list_commits' conditional fields.
 - **Research doc:** plugins/gitea/docs/research/docs/gitea/sources.md
 - **Contributing files:** references/branches.md, references/commits.md
 - **Status:** `extracted`